Skip to content
QuantumScanPublic scan report

Repository

mwiede/jsch

Scanned on Jun 5, 2026

78

Risk score/ 100

High risk

Summary

JSch library has critical post-quantum cryptography vulnerabilities with 30 broken algorithm implementations and 165 quantum-vulnerable cryptographic primitives. The codebase extensively uses RSA, DSA, ECDSA, and legacy ciphers (3DES, Blowfish) that will be completely broken by quantum computers, creating significant long-term security and compliance risks. Immediate migration planning to NIST-approved post-quantum algorithms is essential for regulatory compliance and future-proofing.

Critical

30

High

165

Medium

5

Low

0

Top findings

  • Critical3DES / TripleDES

    examples/ScpToNoneCipher.java:50

  • CriticalRSA key ≤ 2048 bits

    src/main/java/com/jcraft/jsch/AgentProxy.java:128

  • CriticalRSA key ≤ 2048 bits

    src/main/java/com/jcraft/jsch/ChannelAgentForwarding.java:210

  • CriticalRSA key ≤ 2048 bits

    examples/KeyGenOpenSSHv1.java:14

  • Critical3DES / TripleDES

    examples/AES.java:44

+ 195 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan